[dns-operations] Possibly-incorrect NSEC responses from many RSOs
ietf-dane at dukhovni.org
Sun Feb 28 01:58:55 UTC 2021
On Sun, Feb 28, 2021 at 12:32:23PM +1100, Mark Andrews wrote:
> It says that RRSIGs exist at that name.
But there is no *signed* RRSIG RRSet as such, and positive responses to
queries with type RRSIG are always insecure, and can always just be
outright lies, with no way to check.
Since the NSEC bitmap protects against NODATA forgery, it makes no sense
to include RRSIG here, because any RRSIG response can never be
So it makes no sense to include RRSIG in the NSEC bitmap. This still
looks like a mistake.
More information about the dns-operations